falso
/
cdesktopenv
mirror of https://git.code.sf.net/p/cdesktopenv/code
1
0
Fork 0
Code Issues Releases Wiki Activity
cdesktopenv/cde/programs/dtcreate
History
Trung Lê 72d0164644 Security: replace tmpnam() with mkstemp() 
tmpnam() is inherently insecure due to race conditions between
filename generation and file creation (CWE-377). Replace all
occurrences with mkstemp() which atomically creates the file.

Pattern used (portable, already used elsewhere in CDE):
  strcpy(tmpName, "/tmp/dtXXX_XXXXXX");
  { int _tf = mkstemp(tmpName); if (_tf >= 0) close(_tf); }

Files modified:
- lib/DtHelp/Access.c (2 occurrences)
- lib/DtSvc/DtUtil1/DtsMM.c (1 occurrence)
- lib/DtWidget/Editor.c (2 occurrences)
- lib/DtWidget/SearchCalls.c (1 occurrence)
- programs/dtcreate/main.c (2 occurrences)
- programs/dticon/main.c (1 occurrence)
- programs/dtlogin/policy.c (1 occurrence)
- programs/dtpad/fileIo.c (1 occurrence)
- programs/dtpdm/PdmXp.c (1 occurrence)
- programs/dtpdmd/manager.c (1 occurrence)
- programs/dtspcd/main.c (1 occurrence)
- programs/dtwm/WmResParse.c (1 occurrence)

Note: dtksh/ksh93 directory intentionally skipped (vendored code)
 		2026-01-29 17:10:18 +11:00
..
AddFiletype.c dtcreate: Resolve uninitialized warnings 2021-12-24 10:50:28 -07:00
AddFiletype.h Fix typo in license headers 2018-04-28 12:30:20 -06:00
Confirmed.c Fix typo in license headers 2018-04-28 12:30:20 -06:00
Confirmed.h Fix typo in license headers 2018-04-28 12:30:20 -06:00
CreateActionAppShell.c Fix typo in license headers 2018-04-28 12:30:20 -06:00
CreateActionAppShell.h Fix typo in license headers 2018-04-28 12:30:20 -06:00
Dtcreate Initial import of the CDE 2.1.30 sources from the Open Group. 2012-03-10 18:21:40 +00:00
ErrorDialog.c dtcreate: make pop-ups work properly. 2024-09-09 06:39:02 +00:00
ErrorDialog.h Fix typo in license headers 2018-04-28 12:30:20 -06:00
FileCharacteristics.c handle missing return values 2025-12-18 22:58:26 +01:00
FileCharacteristics.h Fix typo in license headers 2018-04-28 12:30:20 -06:00
Makefile.am configure: detect libdl 2022-07-31 18:33:49 -06:00
OpenFile.c Fix typo in license headers 2018-04-28 12:30:20 -06:00
OpenFile.h Fix typo in license headers 2018-04-28 12:30:20 -06:00
UxXt.c Fix typo in license headers 2018-04-28 12:30:20 -06:00
UxXt.h Fix typo in license headers 2018-04-28 12:30:20 -06:00
af_aux.c Fix several pointer-bool-conversion warnings that could cause cores 2021-12-11 17:39:35 -07:00
af_aux.h Handle changes needed for C23 compatibility that turns on strict ansi prototypes by default. C23 is now the default for GCC 15 2025-12-31 15:06:27 +00:00
ca_aux.c Use POSIX macros for linux 2018-05-24 18:22:55 -06:00
ca_aux.h Fix typo in license headers 2018-04-28 12:30:20 -06:00
cmncbs.c Handle changes needed for C23 compatibility that turns on strict ansi prototypes by default. C23 is now the default for GCC 15 2025-12-31 15:06:27 +00:00
cmncbs.h Fix typo in license headers 2018-04-28 12:30:20 -06:00
cmnrtns.c Fix several pointer-bool-conversion warnings that could cause cores 2021-12-11 17:39:35 -07:00
cmnrtns.h Fix typo in license headers 2018-04-28 12:30:20 -06:00
cmnutils.c Fix memory leaks 2025-12-18 22:58:26 +01:00
cmnutils.h Fix typo in license headers 2018-04-28 12:30:20 -06:00
dtcreate.ddf Initial import of the CDE 2.1.30 sources from the Open Group. 2012-03-10 18:21:40 +00:00
dtcreate.h Centralize catgets() calls through MsgCat 2021-06-02 19:55:15 -06:00
dtcreate.msg correction of message files 2013-09-15 19:35:53 -06:00
dtcreate.sh Initial import of the CDE 2.1.30 sources from the Open Group. 2012-03-10 18:21:40 +00:00
fileio.c Fix typo in license headers 2018-04-28 12:30:20 -06:00
fileio.h Fix typo in license headers 2018-04-28 12:30:20 -06:00
icon_selection_dialog.c Handle changes needed for C23 compatibility that turns on strict ansi prototypes by default. C23 is now the default for GCC 15 2025-12-31 15:06:27 +00:00
icon_selection_dialog.h Handle changes needed for C23 compatibility that turns on strict ansi prototypes by default. C23 is now the default for GCC 15 2025-12-31 15:06:27 +00:00
main.c Security: replace tmpnam() with mkstemp() 2026-01-29 17:10:18 +11:00
nlsREADME.txt Initial import of the CDE 2.1.30 sources from the Open Group. 2012-03-10 18:21:40 +00:00
parser.c dtcreate: Resolve uninitialized warnings 2021-12-24 10:50:28 -07:00
parser.h Fix typo in license headers 2018-04-28 12:30:20 -06:00